diff --git a/.github/workflows/contract.yml b/.github/workflows/contract.yml
index 95371c32..670f4c60 100644
--- a/.github/workflows/contract.yml
+++ b/.github/workflows/contract.yml
@@ -50,7 +50,10 @@ jobs:
           docker images blockstor-drbd-contract:local
 
       - name: Contract tests
+        # pipefail: without it `| tee` masks go test's exit code and
+        # the job goes green even when the suite fails.
         run: |
+          set -o pipefail
           go test -tags=contract -count=1 -timeout=5m -v ./tests/contract/... \
             | tee contract.log
 
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 22fb847a..197442fd 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -78,7 +78,10 @@ jobs:
         run: go build ./...
 
       - name: Integration tests
+        # pipefail: without it `| tee` masks go test's exit code and
+        # the job goes green even when the suite fails.
         run: |
+          set -o pipefail
           go test -tags=integration -count=1 -timeout=15m ./tests/integration/... | tee integration.log
 
       - name: Upload logs on failure
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index 1c9e57c6..d97aedb8 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -120,7 +120,10 @@ jobs:
           docker build -t blockstor-drbd-contract:local \
             -f tests/contract/Dockerfile tests/contract/
       - name: Contract tests
+        # pipefail: without it `| tee` masks go test's exit code and
+        # the job goes green even when the suite fails.
         run: |
+          set -o pipefail
           go test -tags=contract -count=1 -timeout=5m -v ./tests/contract/... \
             | tee contract.log
       - name: Upload logs on failure
@@ -171,7 +174,10 @@ jobs:
       - name: Build (ensures harness compiles)
         run: go build ./...
       - name: Integration tests
+        # pipefail: without it `| tee` masks go test's exit code and
+        # the job goes green even when the suite fails.
         run: |
+          set -o pipefail
           go test -tags=integration -count=1 -timeout=15m ./tests/integration/... | tee integration.log
       - name: Upload logs on failure
         if: failure()